Dave doesn't need a private key, the token just needs the ability to be traded. One of the more complex aspects of OCAPy design vs the we do things now is that

Dave doesn't need a private key, the token just needs the ability to be traded. One of the more complex aspects of OCAPy design vs the we do things now is that in a fully ocap world, the token wouldn't just be a string, but possibly a reference to a living object that Alice owns. Then the trade (and any use of the capability) always goes through Alice. That's why you don't need crypto in a real OCAP world.